Splunk Search

How to search average response + total application count for last 6 months with span of 1 month

ngaviran
New Member

I am trying to query and not able to get the output , only i am getting host names, Avg response , count , but need Span of 1 month also in the output .

below is the search queary where i expecting month on month column output also ...
sourcetype="ats_request" host!=dc* | stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host

Tags (1)
0 Karma

kmaron
Motivator

Try this

sourcetype="ats_request" host!=dc* 
| bucket _time span=1mon
| stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host _time
0 Karma

ngaviran
New Member

Thanks a lot, it works for me @kmaron

0 Karma

kmaron
Motivator

Since it worked for you please accept my answer so others know your question was answered.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...